Designing Antiphishing Education

Introduction

Phishing is generally described as sending computer users messages claiming to originate from a legitimate entity and attempting to lead the user to provide private information that will be further used for identity theft (“Phishing,” 2006). While the nature of the message (and the purported originating entity) varies from with each individual attack, one can notice that the entities continue to diversify and that the sole number of such attacks is staggering. A brief review of phishing related news for the first seven days of November 2006 in chronological order is shown in Figure 1. Such bleak reality is shared by professional reports that suggest that the number of reported phishing attempts has almost doubled between August 2005 and August 2006 (“Phishing Activity Trends Report - September 2006,” 2006).

Figure 1.

Survey of phishing related news for the first week of November 2006

Faced with an increasing threat, software companies, federal agencies, financial and commercial institutions and internet service providers have increased their antiphishing efforts. Statistics are now being compiled monthly monitoring the threat level, and repositories of phishing events have been created (and are publicly available). As the variety of phishing techniques increase, more defense tools/methods are developed. In recent versions of the internet browsers, ‘anti-phishing’ filters are provided (an application component that checks the website against a list of known phishing sites) (Microsoft, 2006). Log-in procedures have been revamped by requiring multi-step authentication and changing challenge-response pairs (Schechter, Dhamija, Ozment, & Fischer, 2007). Despite all this effort from the IT world, people continue to fall victim to phishing tactics. It is therefore necessary to improve upon previous methods of education to help protect an increasingly vulnerable population. Thus, we present an educational method that can be used to help teach users how to protect themselves from phishing associated identity theft. To better understand how to identify a phishing attack, people need to learn how and why phishing works. Hence, it is imperative to show the reasons phishing is so successful as well as why it has become one of the top cyber threats of the new millennium. With this knowledge people should be able to see their own mistakes in phishing identification and be able to reduce the problem.

In the following, we start by providing a survey of the ‘state of the art’ in phishing. Next, we describe the current phishing education strategies we developed and implemented. The educational method includes phishing detection tests, as well as an education session that starts by defining the threat and builds that knowledge into means for phish identification. The education module has been already administered to approximately 120 undergraduate students at Montclair State University. Survey results indicate an increased awareness of the issue and an increased ability to detect phishing attempts.